Decoding history's biggest crypto heist: How Binance's $6 bn hack rattled mkts
The world’s largest cryptocurrency exchange, Binance, has faced what appears to be the biggest crypto heist in history, with the total impact of the security breach being estimated to be more than $6 billion, rattling the crypto markets and spooking investors across the globe.
Binance on Thursday said it is investigating reports of a potential security breach, while its founder said the incident “does look like a hack on Binance.” In a post on X, Binance announced that its initial investigation found that the incident may have arisen from a hacked laptop of a DevOps engineer, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
Is North Korea behind Binance's security breach?
US blockchain analysis firm TRM Labs meanwhile said that North Korean hackers may be behind a $6.3 billion security hack on Binance. "An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM Labs said in a blog post on its website.
"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on- and off-chain intelligence. We make this judgment with high confidence,” it further said. The FBI had named TraderTraitor as responsible for the $1.5 billion Bybit hack in February 2025.
TRM said several features of the latest hack on Binance match the earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026. This includes small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance, then executed in one burst.
Also read | Blockchain analysis firm TRM says North Korea behind Binance crypto theft
How will investors be impacted?
After the massive security breach, around $3 billion in cryptocurrency assets froze, and Binance pledged to cover all losses. It also temporarily suspended deposits and withdrawals, revoked the affected address authorisation, and enlisted law enforcement and blockchain intelligence firms to trace and recover funds.
“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” Binance said. Several cryptocurrency firms, including stablecoin issuers Circle and Tether, froze a combined $2.54 billion in funds linked to the suspected incident on Thursday.
Binance co-founder Yi He said customers’ deposits remain unaffected and continue to operate as normal. “Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resuming withdrawal services in the next 48 hours,” she added.
Binance said it would cover all losses using its Secure Asset Fund for Users and company funds, adding that customer funds are safe. "We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," it added.
Binance security hack rattles crypto markets
As a result of the security breach at the world’s largest crypto exchange, Bitcoin dropped 3% to hit a six-week low below $76,500. Ether fell over 3% to trade near $2,185.
Shares of crypto exchange Coinbase Global dropped 5% while those of bitcoin buyer Strategy fell nearly 6% in extended US trading.
Also read | Binance flags 'potential security issue,' says approximately $6.3 billion impacted
(With inputs from agencies)
Disclaimer: This article has been written by Debaroti Adhikary, who is not a SEBI-registered Research Analyst or an Investment Adviser. Debaroti Adhikary and his/her ‘relative(s)’ (as defined under Section 2(77) of the Companies Act, 2013) do not hold any financial interest in the companies mentioned in this article as of the date of publication. The views/recommendations mentioned in this article, wherever applicable, are those of the respective SEBI-registered Research Analyst/brokerage and have been reproduced/reported with due attribution. They should not be construed as the views or recommendations of The Economic Times Digital or the journalist. Readers are advised to consider the original research report and make their investment decisions based on their own assessment. Brokerage disclaimers here.
Binance on Thursday said it is investigating reports of a potential security breach, while its founder said the incident “does look like a hack on Binance.” In a post on X, Binance announced that its initial investigation found that the incident may have arisen from a hacked laptop of a DevOps engineer, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.
Is North Korea behind Binance's security breach?
US blockchain analysis firm TRM Labs meanwhile said that North Korean hackers may be behind a $6.3 billion security hack on Binance. "An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes," TRM Labs said in a blog post on its website.
"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on- and off-chain intelligence. We make this judgment with high confidence,” it further said. The FBI had named TraderTraitor as responsible for the $1.5 billion Bybit hack in February 2025.
TRM said several features of the latest hack on Binance match the earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026. This includes small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance, then executed in one burst.
Also read | Blockchain analysis firm TRM says North Korea behind Binance crypto theft
How will investors be impacted?
After the massive security breach, around $3 billion in cryptocurrency assets froze, and Binance pledged to cover all losses. It also temporarily suspended deposits and withdrawals, revoked the affected address authorisation, and enlisted law enforcement and blockchain intelligence firms to trace and recover funds.
“We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified,” Binance said. Several cryptocurrency firms, including stablecoin issuers Circle and Tether, froze a combined $2.54 billion in funds linked to the suspected incident on Thursday.
Binance co-founder Yi He said customers’ deposits remain unaffected and continue to operate as normal. “Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resuming withdrawal services in the next 48 hours,” she added.
Binance said it would cover all losses using its Secure Asset Fund for Users and company funds, adding that customer funds are safe. "We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified," it added.
Binance security hack rattles crypto markets
As a result of the security breach at the world’s largest crypto exchange, Bitcoin dropped 3% to hit a six-week low below $76,500. Ether fell over 3% to trade near $2,185.
Shares of crypto exchange Coinbase Global dropped 5% while those of bitcoin buyer Strategy fell nearly 6% in extended US trading.
Also read | Binance flags 'potential security issue,' says approximately $6.3 billion impacted
(With inputs from agencies)
Disclaimer: This article has been written by Debaroti Adhikary, who is not a SEBI-registered Research Analyst or an Investment Adviser. Debaroti Adhikary and his/her ‘relative(s)’ (as defined under Section 2(77) of the Companies Act, 2013) do not hold any financial interest in the companies mentioned in this article as of the date of publication. The views/recommendations mentioned in this article, wherever applicable, are those of the respective SEBI-registered Research Analyst/brokerage and have been reproduced/reported with due attribution. They should not be construed as the views or recommendations of The Economic Times Digital or the journalist. Readers are advised to consider the original research report and make their investment decisions based on their own assessment. Brokerage disclaimers here.
Next Story